Merge branch 'develop' into ab/bump-otel

# Conflicts:
#	dev-packages/node-core-integration-tests/package.json
#	packages/aws-serverless/package.json
#	packages/nestjs/package.json
#	packages/node-core/package.json
#	packages/node/package.json
#	packages/react-router/package.json
#	packages/tanstackstart-react/package.json
#	packages/vercel-edge/package.json

Agent transcript: https://claudescope.sentry.dev/share/TCryj2s1bu6Aw7QWt9CGGKdBk-VdfS-1PmBfYchAt4A

Author: andreiborza

.github/workflows/build.yml

@@ -308,7 +308,7 @@ jobs:
         with:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
       - name: Lint source files
-        run: yarn lint:oxlint
+        run: yarn lint
       - name: Lint for ES compatibility
         run: yarn lint:es-compatibility
 

.github/workflows/canary.yml

@@ -69,9 +69,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - test-application: 'angular-20'
+          - test-application: 'angular-21'
             build-command: 'test:build-canary'
-            label: 'angular-20 (next)'
+            label: 'angular-21 (next)'
           - test-application: 'create-react-app'
             build-command: 'test:build-canary'
             label: 'create-react-app (canary)'
@@ -130,7 +130,6 @@ jobs:
         with:
           version: 9.15.9
       - name: Set up Node
-        if: matrix.test-application != 'angular-20'
         uses: actions/setup-node@v6
         with:
           node-version-file: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'

.oxlintrc.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": ["typescript", "import", "jsdoc", "jest", "vitest"],
+  "plugins": ["typescript", "import", "jsdoc", "vitest"],
   "jsPlugins": [
     {
       "name": "sdk",
@@ -9,6 +9,11 @@
   ],
   "categories": {},
   "rules": {
+    "no-unused-vars": [
+      "warn",
+      { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_", "caughtErrorsIgnorePattern": "^_" }
+    ],
+
     // === Base rules from eslint-config-sdk/base.js ===
     "no-console": "error",
     "no-alert": "error",
@@ -27,28 +32,18 @@
     "import/namespace": "off",
     "import/no-unresolved": "off",
 
-    // === Jest/Vitest rules ===
-    "jest/no-focused-tests": "error",
-    "jest/no-disabled-tests": "error",
-
     // === Rules turned off (not enforced in ESLint or causing false positives) ===
     "no-control-regex": "off",
     "jsdoc/check-tag-names": "off",
     "jsdoc/require-yields": "off",
     "no-useless-rename": "off",
     "no-constant-binary-expression": "off",
-    "jest/no-conditional-expect": "off",
-    "jest/expect-expect": "off",
-    "jest/no-standalone-expect": "off",
-    "jest/require-to-throw-message": "off",
-    "jest/valid-title": "off",
-    "jest/no-export": "off",
-    "jest/valid-describe-callback": "off",
     "vitest/hoisted-apis-on-top": "off",
     "vitest/no-conditional-tests": "off",
     "no-unsafe-optional-chaining": "off",
     "no-eval": "off",
     "no-import-assign": "off",
+    "typescript/no-duplicate-type-constituents": "off",
 
     // === Custom SDK rules (via JS plugin) ===
     "sdk/no-eq-empty": "error"
@@ -61,17 +56,17 @@
         "typescript/consistent-type-imports": "error",
         "typescript/no-unnecessary-type-assertion": "error",
         "typescript/prefer-for-of": "error",
-        // "typescript/no-floating-promises": ["error", { "ignoreVoid": false }],
+        "typescript/no-floating-promises": ["error", { "ignoreVoid": true }],
         "typescript/no-dynamic-delete": "error",
-        // "typescript/no-unsafe-member-access": "error",
+        "typescript/no-unsafe-member-access": "error",
         "typescript/unbound-method": "error",
         "typescript/no-explicit-any": "error",
         "typescript/no-empty-function": "off",
-
-        // === FIXME: Rules to turn back as error ===
-        "typescript/prefer-optional-chain": "warn",
-        "typescript/no-floating-promises": "warn",
-        "typescript/no-unsafe-member-access": "warn"
+        "typescript/prefer-optional-chain": ["error"],
+        "typescript/no-redundant-type-constituents": "off",
+        "typescript/restrict-template-expressions": "off",
+        "typescript/await-thenable": "warn",
+        "typescript/no-base-to-string": "warn"
       }
     },
     {
@@ -111,7 +106,12 @@
         "typescript/no-floating-promises": "off",
         "typescript/unbound-method": "off",
         "max-lines": "off",
-        "complexity": "off"
+        "complexity": "off",
+        "typescript/prefer-optional-chain": "off",
+        "typescript/no-misused-spread": "off",
+        "typescript/require-array-sort-compare": "off",
+        "typescript/no-base-to-string": "off",
+        "typescript/await-thenable": "off"
       }
     },
     {

.size-limit.js

@@ -82,7 +82,7 @@ module.exports = [
     path: 'packages/browser/build/npm/esm/prod/index.js',
     import: createImport('init', 'browserTracingIntegration', 'replayIntegration', 'replayCanvasIntegration'),
     gzip: true,
-    limit: '86 KB',
+    limit: '87 KB',
   },
   {
     name: '@sentry/browser (incl. Tracing, Replay, Feedback)',
@@ -124,7 +124,7 @@ module.exports = [
     path: 'packages/browser/build/npm/esm/prod/index.js',
     import: createImport('init', 'logger'),
     gzip: true,
-    limit: '27 KB',
+    limit: '28 KB',
   },
   {
     name: '@sentry/browser (incl. Metrics & Logs)',
@@ -255,21 +255,21 @@ module.exports = [
     path: createCDNPath('bundle.tracing.logs.metrics.min.js'),
     gzip: false,
     brotli: false,
-    limit: '131 KB',
+    limit: '132 KB',
   },
   {
     name: 'CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed',
     path: createCDNPath('bundle.replay.logs.metrics.min.js'),
     gzip: false,
     brotli: false,
-    limit: '209 KB',
+    limit: '210 KB',
   },
   {
     name: 'CDN Bundle (incl. Tracing, Replay) - uncompressed',
     path: createCDNPath('bundle.tracing.replay.min.js'),
     gzip: false,
     brotli: false,
-    limit: '245 KB',
+    limit: '246 KB',
   },
   {
     name: 'CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed',
@@ -308,7 +308,7 @@ module.exports = [
     import: createImport('init'),
     ignore: ['$app/stores'],
     gzip: true,
-    limit: '43 KB',
+    limit: '44 KB',
   },
   // Node-Core SDK (ESM)
   {
@@ -326,7 +326,7 @@ module.exports = [
     import: createImport('init'),
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: true,
-    limit: '175 KB',
+    limit: '176 KB',
   },
   {
     name: '@sentry/node - without tracing',

.version.json

@@ -1,4 +1,4 @@
 {
   "_comment": "Auto-generated by scripts/bump-version.js. Used by the gitflow sync workflow to detect version bumps. Do not edit manually.",
-  "version": "10.42.0"
+  "version": "10.43.0"
 }

.vscode/settings.json

@@ -28,5 +28,6 @@
   "editor.defaultFormatter": "oxc.oxc-vscode",
   "[typescript]": {
     "editor.defaultFormatter": "oxc.oxc-vscode"
-  }
+  },
+  "oxc.suppressProgramErrors": true
 }

AGENTS.md

@@ -20,9 +20,12 @@ Use **yarn**: `yarn install`, `yarn build:dev`, `yarn test`, `yarn lint`
 | `yarn build:dev:filter @sentry/<pkg>` | Build one package + deps      |
 | `yarn build:bundle`                   | Browser bundles only          |
 | `yarn test`                           | All unit tests                |
-| `yarn lint`                           | Oxlint + Oxfmt                |
-| `yarn fix`                            | Auto-fix lint + format        |
-| `yarn format`                         | Auto-fix formatting (Oxfmt)   |
+| `yarn verify`                         | Lint + format check           |
+| `yarn fix`                            | Format + lint fix             |
+| `yarn lint`                           | Lint (Oxlint)                 |
+| `yarn lint:fix`                       | Lint + auto-fix (Oxlint)      |
+| `yarn format`                         | Format files (Oxfmt)          |
+| `yarn format:check`                   | Check formatting (Oxfmt)      |
 
 Single package: `cd packages/<name> && yarn test`
 

CHANGELOG.md

@@ -2,9 +2,28 @@
 
 ## Unreleased
 
+- "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
+
+- **feat(nestjs): Instrument `@nestjs/schedule` decorators ([#19735](https://github.com/getsentry/sentry-javascript/pull/19735))**
+
+  Automatically capture exceptions thrown in `@Cron`, `@Interval`, and `@Timeout` decorated methods.
+
+  Previously, exceptions in `@Cron` methods were only captured if you used the `SentryCron` decorator. Now they are
+  captured automatically. The exception mechanism type changed from `auto.cron.nestjs.async` to
+  `auto.function.nestjs.cron`. If you have Sentry queries or alerts that filter on the old mechanism type, update them
+  accordingly.
+
+- **feat(astro): Add Astro 6 support ([#19745](https://github.com/getsentry/sentry-javascript/pull/19745))**
+
+  This release enables full support for Astro v6 by adjusting our Astro SDK's middleware to some Astro-internal
+  changes. We cannot yet guarantee full support for server-islands, due to a [bug in Astro v6](https://github.com/withastro/astro/issues/15753)
+  but we'll follow up on this once the bug is fixed.
+
+## 10.43.0
+
 ### Important Changes
 
-- **feat(nextjs): Add Turbopack support for React component name annotation ([#19XXX](https://github.com/getsentry/sentry-javascript/pull/19XXX))**
+- **feat(nextjs): Add Turbopack support for React component name annotation ([#19604](https://github.com/getsentry/sentry-javascript/pull/19604))**
 
   We added experimental support for React component name annotation in Turbopack builds. When enabled, JSX elements
   are annotated with `data-sentry-component`, `data-sentry-element`, and `data-sentry-source-file` attributes at build
@@ -27,9 +46,49 @@
   });
   ```
 
+- **feat(hono): Instrument middlewares `app.use()` ([#19611](https://github.com/getsentry/sentry-javascript/pull/19611))**
+
+  Hono middleware registered via `app.use()` is now automatically instrumented, creating spans for each middleware invocation.
+
 ### Other Changes
 
-- "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
+- feat(node-core,node): Add `tracePropagation` option to http and fetch integrations ([#19712](https://github.com/getsentry/sentry-javascript/pull/19712))
+- feat(hono): Use parametrized names for errors ([#19577](https://github.com/getsentry/sentry-javascript/pull/19577))
+- fix(browser): Fix missing traces for user feedback ([#19660](https://github.com/getsentry/sentry-javascript/pull/19660))
+- fix(cloudflare): Use correct Proxy receiver in `instrumentDurableObjectStorage` ([#19662](https://github.com/getsentry/sentry-javascript/pull/19662))
+- fix(core): Standardize Vercel AI span descriptions to align with GenAI semantic conventions ([#19624](https://github.com/getsentry/sentry-javascript/pull/19624))
+- fix(deps): Bump hono to 4.12.5 to fix multiple vulnerabilities ([#19653](https://github.com/getsentry/sentry-javascript/pull/19653))
+- fix(deps): Bump svgo to 4.0.1 to fix DoS via entity expansion ([#19651](https://github.com/getsentry/sentry-javascript/pull/19651))
+- fix(deps): Bump tar to 7.5.10 to fix hardlink path traversal ([#19650](https://github.com/getsentry/sentry-javascript/pull/19650))
+- fix(nextjs): Align Turbopack module metadata injection with webpack behavior ([#19645](https://github.com/getsentry/sentry-javascript/pull/19645))
+- fix(node): Prevent duplicate LangChain spans from double module patching ([#19684](https://github.com/getsentry/sentry-javascript/pull/19684))
+- fix(node-core,vercel-edge): Use HEROKU_BUILD_COMMIT env var for default release ([#19617](https://github.com/getsentry/sentry-javascript/pull/19617))
+- fix(sveltekit): Fix file system race condition in source map cleaning ([#19714](https://github.com/getsentry/sentry-javascript/pull/19714))
+- fix(tanstackstart-react): Add workerd and worker export conditions ([#19461](https://github.com/getsentry/sentry-javascript/pull/19461))
+- fix(vercel-ai): Prevent tool call span map memory leak ([#19328](https://github.com/getsentry/sentry-javascript/pull/19328))
+- feat(deps): Bump @sentry/rollup-plugin from 5.1.0 to 5.1.1 ([#19658](https://github.com/getsentry/sentry-javascript/pull/19658))
+
+<details>
+  <summary> <strong>Internal Changes</strong> </summary>
+
+- chore: Migrate to oxlint ([#19134](https://github.com/getsentry/sentry-javascript/pull/19134))
+- chore(aws-serverless): Don't build layer in `build:dev` command ([#19586](https://github.com/getsentry/sentry-javascript/pull/19586))
+- chore(ci): Allow triage action to run on issues from external users ([#19701](https://github.com/getsentry/sentry-javascript/pull/19701))
+- chore(deps): Bump immutable from 4.0.0 to 4.3.8 ([#19637](https://github.com/getsentry/sentry-javascript/pull/19637))
+- chore(e2e): Expand microservices E2E application with auto-tracing tests ([#19652](https://github.com/getsentry/sentry-javascript/pull/19652))
+- chore(hono): Prepare readme and add craft entry ([#19583](https://github.com/getsentry/sentry-javascript/pull/19583))
+- chore(sourcemaps): Make sourcemaps e2e test more generic ([#19678](https://github.com/getsentry/sentry-javascript/pull/19678))
+- chore(tanstackstart-react): Add link to docs in README ([#19697](https://github.com/getsentry/sentry-javascript/pull/19697))
+- feat(deps): Bump @hono/node-server from 1.19.4 to 1.19.10 ([#19634](https://github.com/getsentry/sentry-javascript/pull/19634))
+- feat(deps): Bump underscore from 1.12.1 to 1.13.8 ([#19616](https://github.com/getsentry/sentry-javascript/pull/19616))
+- test(angular): Fix failing canary test ([#19639](https://github.com/getsentry/sentry-javascript/pull/19639))
+- test(nextjs): Add sourcemaps test for nextjs turbopack ([#19647](https://github.com/getsentry/sentry-javascript/pull/19647))
+- tests(e2e): Add microservices e2e for nestjs ([#19642](https://github.com/getsentry/sentry-javascript/pull/19642))
+- tests(e2e): Add websockets e2e for nestjs ([#19630](https://github.com/getsentry/sentry-javascript/pull/19630))
+
+</details>
+
+Work in this release was contributed by @dmmulroy, @lithdew, and @smorimoto. Thank you for your contributions!
 
 ## 10.42.0
 

dev-packages/.oxlintrc.json

@@ -4,6 +4,10 @@
   "rules": {
     "typescript/no-explicit-any": "off",
     "max-lines": "off",
-    "no-unused-expressions": "off"
+    "no-unused-expressions": "off",
+    "typescript/require-array-sort-compare": "off",
+    "typescript/no-misused-spread": "off",
+    "typescript/no-base-to-string": "off",
+    "typescript/await-thenable": "off"
   }
 }

dev-packages/browser-integration-tests/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry-internal/browser-integration-tests",
-  "version": "10.42.0",
+  "version": "10.43.0",
   "main": "index.js",
   "license": "MIT",
   "engines": {
@@ -10,8 +10,8 @@
   "scripts": {
     "clean": "rimraf -g suites/**/dist loader-suites/**/dist tmp",
     "install-browsers": "[[ -z \"$SKIP_PLAYWRIGHT_BROWSER_INSTALL\" ]] && npx playwright install --with-deps || echo 'Skipping browser installation'",
-    "lint": "oxlint .",
-    "fix": "oxlint . --fix",
+    "lint": "OXLINT_TSGOLINT_DANGEROUSLY_SUPPRESS_PROGRAM_DIAGNOSTICS=true oxlint . --type-aware",
+    "lint:fix": "OXLINT_TSGOLINT_DANGEROUSLY_SUPPRESS_PROGRAM_DIAGNOSTICS=true oxlint . --fix --type-aware",
     "type-check": "tsc",
     "postinstall": "yarn install-browsers",
     "pretest": "yarn clean && yarn type-check",
@@ -60,7 +60,7 @@
     "@babel/preset-typescript": "^7.16.7",
     "@playwright/test": "~1.56.0",
     "@sentry-internal/rrweb": "2.34.0",
-    "@sentry/browser": "10.42.0",
+    "@sentry/browser": "10.43.0",
     "@supabase/supabase-js": "2.49.3",
     "axios": "^1.12.2",
     "babel-loader": "^10.0.0",